Privacy policy
Effective June 12, 2026 · Updated October 15, 2026 · uplift.page is operated by Uplift Duo.
What we collect
- Public API requests: route, query text, prompt slug, IP (for rate limiting), user agent, optional model name, latency, status. Retained for analytics and abuse prevention.
- Accounts: email and authentication data, handled by Supabase Auth. Passwords are never visible to us.
- Workspace telemetry: events your systems explicitly send with your ingest key (skill runs, models, durations, repos). This is your data, scoped to your workspace.
- Feedback: outcomes and messages submitted to /v1/feedback, attributed to a prompt and optionally a model.
- Billing: handled by Stripe. We store your Stripe customer/subscription identifiers, never card details.
- Web analytics: Google Analytics 4 on the public pages (home, library, prompt and skill pages, docs, guides, pricing, legal). It records page views, the referring site, device and browser type, approximate location derived from your IP address, and basic interactions such as scrolling and outbound link clicks. Search text and other query parameters are removed before anything is sent; only the library category and campaign tags (utm_*) are kept. Google Analytics never loads in the dashboard, admin, account, or sign-in pages.
- Prompt page views: opening a prompt or skill page (/p/…) records one view per browser session, with the page, a one-way hash of your IP address (the address itself is not stored), and your browser's user agent. Views are kept to one per visitor, prompt and day, and set the library's most-used order. This uses no cookies; a sessionStorage flag stops your browser counting the same page twice in one session.
- Performance metrics: Vercel Speed Insights (cookieless) measures page load timings on every page.
Cookies
- Sign-in: Supabase Auth cookies (
sb-…) keep you signed in. They are required for the dashboard and are only set when you sign in. - Analytics: Google Analytics sets
_gaand_ga_YLT130KW9Gwhen you open a public page. They hold a random ID so repeat visits are counted once, and they expire after up to two years. We use the reports in aggregate, to see which pages and prompts are useful.
To opt out of Google Analytics, install Google's opt-out browser add-on, block third-party analytics in your browser or a content blocker, or delete the _ga cookies. The site works the same without them.
What we do with it
Operate the service, show you your own analytics, enforce rate limits and plan quotas, and improve the public prompt library using aggregate feedback.
What we never do
- Sell or share personal data or workspace telemetry with third parties.
- Train models on your private prompts or telemetry.
- Embed hidden tracking in served prompts - removing that is literally the product. Instrumentation on your own prompts is opt-in and visible in the prompt text.
Your controls
- Export: your workspace data is queryable through the dashboard and API at any time.
- Deletion: email privacy@uplift.page to delete your account and workspace data; we complete within 30 days.
- Webhook forwarding: mirror every telemetry event to your own server, so leaving never means losing.
Subprocessors
Supabase (database, auth), Vercel (hosting, performance metrics), Google (web analytics), Stripe (payments).